generated: '2026-07-19'
method: derived
source: openapi/lingopal-openapi-original.json
docs: https://docs.lingopal.ai/
standards:
- id: openapi-3.1
  conforms: true
  evidence: openapi field is "3.1.0" and the spec is published at https://docs.lingopal.ai/openapi/v2.json
- id: api-key-auth
  conforms: true
  evidence: components.securitySchemes.APIKeyHeader is type apiKey, in header, name X-API-Key, applied globally via security[]
- id: oauth2
  conforms: false
  evidence: no oauth2 security scheme in the spec; the docs state bearer tokens are not used
- id: oidc
  conforms: false
- id: rfc9457-problem-details
  conforms: false
  evidence: error responses are application/json with a FastAPI-style detail[] envelope, not application/problem+json
- id: rfc8594-sunset-header
  conforms: false
  evidence: no deprecation or sunset policy published
- id: json-api
  conforms: false
- id: odata
  conforms: false
- id: scim2
  conforms: false
- id: fhir-r4
  conforms: false
- id: fapi
  conforms: false
- id: psd2
  conforms: false
- id: idempotency-key
  conforms: false
  evidence: no idempotency key header documented; retry guidance is backoff plus the job reset flag
- id: pagination
  conforms: false
  evidence: no cursor or offset parameters on any collection response
- id: bcp47-language-tags
  conforms: true
  evidence: locale codes returned by listLanguages and consumed by workflows are BCP 47 style (es, pt-BR, af-ZA)
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returns 404 on lingopal.ai, api.lingopal.ai and docs.lingopal.ai
compliance_program:
  published: false
  certifications: []
  note: >-
    No trust center, compliance page, or named certification (SOC 2, ISO 27001, HIPAA,
    GDPR posture page) was found on the marketing site, docs, or at trust./security.
    subdomains. No Compliance pointer is emitted.